Primers
Determining where data is stored is a necessary part of every digital forensics case. When a user creates a file, it must be stored somewhere. A computer can also create other files in the background that can be just as crucial to a case.
Digital forensics is the application of scientific tests or techniques to collect digital evidence in connection with litigation or other types of investigation. It is an integral part of the legal discovery process, but can also be a valuable tool for avoiding or shortening litigation.
Digital evidence can be found on and retrieved from almost any electronic device and an experienced digital forensic examiner can help you determine what otherwise overlooked devices may hold information relevant to your investigation.
With more employees leveraging cloud collaboration platforms during the COVID-19 crisis, the need to acquire Slack data for investigative or discovery purposes will undoubtedly increase.
Individuals and organizations share massive amounts of information on social media both voluntarily and involuntarily. In some cases, this information can be the primary piece of evidence in a lawsuit or investigation: the selfie while holding contraband or the post disparaging one’s employer.
Metadata is data that provides information about other data. For example: the text of a Word document is data; the information about who authored the document and when it was created is metadata. In a lawsuit or an investigation, the metadata can be at least as important as the data itself.
Typically, it will take 2 hours. But this can easily be reduced to 1 hour, or be expanded to 4-6 hours. Sometimes longer! The more information you can provide to the forensics examiner, the better estimate they will be able to provide.
Google Vault is an eDiscovery and email archiving application covering the G Suite. It allows companies to manage, retain, search, and export data from Google applications.
Deleted data is the most valuable digital evidence in many cases; it provides access to information that the user may believe is gone. Data is often deleted to hide deceptive or malicious activity. Understanding the basics of data storage and deletion is key to identifying likely sources of evidence.
Office 365 offers eDiscovery and searching within the platform, for administrators or any authorized users to run searches and review/monitor user activity.
Mobile devices, including cellphones, smartphones, and tablets, contain an astonishing amount of information about their users and the people or organizations they interact with. With the right equipment and expertise, this raw data can be collected and interpreted and reveal details that may be critical to a case.
In addition to FRCP Rule 26, every attorney should take these 10 issues into consideration when planning eDiscovery efforts.
Popular Topics
Analyzing malware can be crucial for triaging an incident to determine what, if any, information was lost and what actions need to be taken next to protect against further incidents.
The digital forensics field grows as fast as technology does. In modern litigation, there is a vast array of digital evidence beyond cell phones and computer workstations. Every new product or technological development presents a new source of data that can be relevant in an investigation.
Fitness tracking applications perform many functions designed to assist the athlete. In the legal realm, these same functions can also be used to help discover the truth.
Email evidence can prove valuable to a case. However, it is important to thoroughly authenticate emails used in litigation. Failure to prove the validity of an email item could render a crucial piece of evidence inadmissible in court.
AirDrop logs are stored within the sysdiagnose log archive on iOS devices, and contain a plethora of valuable information. These logs can contain useful information showing files transferred to and from the device via AirDrop.
On a mobile device or computer, communications can exist across a variety of applications; IM and text messages are just the start of the potentially-relevant user messages. People hold conversations across forums, social media, game platforms, and team collaboration software.
Technical Topics for Non-Technical People
A digital forensic investigation often aims to determine the activities of a user on a computer. Prefetch files are an important type of evidence, which provide detailed information about the programs that were run on a computer.
With the widespread use of the Graphical User Interface (GUI) based operating systems starting around the 1990s, most people have long forgotten the use of command line tools to perform data tasks.
Software that allows remote access to computers keeps logs to identify which computers were accessing the computer, when, and sometimes what they were doing. This can be critical in identifying those with malicious intent.
There’s a lot of misinformation tied to that term arising from changes in technology and commonly held assumptions. Here are some of the facts around IP addresses.
Google Chrome is the world’s most popular browser, with over 50% market share across all devices globally. Browser data can be critical to a digital investigation and Chrome stores both typical internet usage data as well as some data that is unique to this browser.
Forensic examiners will look at a variety of files and metadata to walk through every website visited, email drafted, and file touched.
Google Vault is an eDiscovery and email archiving application covering the G Suite. It allows companies to manage, retain, search, and export data from Google applications.
This article provides more details about electronic searching that may help you improve your methods for searching documents for litigation.
We recently received the question of whether or not file metadata stays with a file when it is emailed. The answer is usually yes, but it can be a little more complex.
Businesses involved in fraud, employees involved in misconduct, and criminals engaged in computer-related crime all frequently take steps to destroy, conceal, or confuse digital evidence. Depending on the user’s level of sophistication, these efforts can cause critical evidence to be unrecoverable or inadmissible.
